setting IP Bindings and SNAT

Brummbaer

I’ve got a system with 2 IP Adresses and I want to set up Mailcow so that it only uses one.

But I still see that docker uses all IP adresses:

here is an excerpt from docker ps:

mailcow/postfix:1.51 “/docker-entrypoint.…” 20 minutes ago Up 20 minutes 0.0.0.0:25->25/tcp, 0.0.0.0:465->465/tcp, 0.0.0.0:587-

I have set the bindings in mailcow.conf

SMTP_PORT=1.2.3.4:25
SMTPS_PORT=1.2.3.4:465
SUBMISSION_PORT=1.2.3.4:587
IMAP_PORT=1.2.3.4:143
IMAPS_PORT=1.2.3.4:993
POP_PORT=1.2.3.4:110
POPS_PORT=1.2.3.4:995
SIEVE_PORT=1.2.3.4:4190
DOVEADM_PORT=127.0.0.1:19991
SQL_PORT=127.0.0.1:13306

SNAT

SNAT_TO_SOURCE=1.2.3.4

docker-compose logs –tail=500 netfilter-mailcow

gives me just my bans, I don’t see anything about SNAT

Attaching to mailcowdockerized_netfilter-mailcow_1
netfilter-mailcow_1 | Clearing all bans
netfilter-mailcow_1 | Initializing mailcow netfilter chain
netfilter-mailcow_1 | Watching Redis channel F2B_CHANNEL
netfilter-mailcow_1 | Blacklist was changed, it has 9 entries

Am I missing something here?

Thank you

diekuh

Did you run docker-compose up -d?

Brummbaer

diekuh

Yes, multiple times, I even rebooted the server 2 times (not related to this problem though).

diekuh

Reboot or docker-compose restart does not fix it. 🙂

Please post ls -la /opt/mailcow-dockerized or whereever your mailcow is located.

Brummbaer

Here is the contents of /opt/mailcow-dockerized

ls -la /opt/mailcow-dockerized/
total 168
drwxr-xr-x 7 root root 4096 Aug 23 12:07 .
drwxr-xr-x 4 root root 4096 Aug 16 23:48 ..
-rw-r–r– 1 root root 3223 Aug 16 23:48 CODE_OF_CONDUCT.md
-rw-r–r– 1 root root 954 Aug 16 23:48 CONTRIBUTING.md
drwxr-xr-x 7 root root 4096 Aug 16 23:48 data
-rw-r–r– 1 root root 18518 Aug 23 11:57 docker-compose.yml
-rw-r–r– 1 root root 2340 Aug 16 23:48 .drone.yml
-rw-r–r– 1 root root 414 Aug 16 23:48 .editorconfig
-rw-r–r– 1 root root 4986 Aug 16 23:48 .env
-rwxr-xr-x 1 root root 9448 Aug 16 23:48 generate_config.sh
drwxr-xr-x 8 root root 4096 Aug 23 11:57 .git
drwxr-xr-x 3 root root 4096 Aug 16 23:48 .github
-rw-r–r– 1 root root 1438 Aug 16 23:48 .gitignore
drwxr-xr-x 3 root root 4096 Aug 16 23:48 helper-scripts
-rwxr-xr-x 1 root root 656 Aug 16 23:48 install-letsencrypt.sh
-rw-r–r– 1 root root 35141 Aug 16 23:48 LICENSE
-rw——- 1 root root 5110 Aug 23 12:01 mailcow.conf
-rw-r–r– 1 root root 1286 Aug 16 23:48 README.md
-rw-r–r– 1 root root 1746 Aug 16 23:48 .travis.yml
drwxr-xr-x 2 root root 4096 Aug 23 11:56 update_diffs
-rwxr-xr-x 1 root root 22970 Aug 23 11:56 update.sh

PS: This is an older installation that I migrated to a newer server with a restored backup. Don’t know if that makes any difference.

MAGIC

The .env should be a symbolic link to mailcow.conf
Can you try to create one?

Brummbaer

Thanks a lot. 🙂 I didn’t know that and of course when I transferred the folder from the older server it broke the symink.

It works now!

Thanks for the help, I was going nuts in trying to find out why it wouldn’t accept the values.

aronmal

I am using mailcow for quite some time and I also want to use IP Bindings and SNAT to make my life easier. But I want ipv4 and ipv6 compatibility. The docs don’t give advise on how to do so.

Thanks for any help in advance.

esackbauer

aronmal Are you sure? What is missing?
https://docs.mailcow.email/post_installation/firststeps-ip_bindings/
https://docs.mailcow.email/post_installation/firststeps-snat/

aronmal

SNAT mentions IPv6, but IP bindings not.

I found this Gihtub issue that says to add IPv6 additionally in the override.yml.

Also, my server is behind a firewall and uses private addresses. They are getting nattet in and outbound. My server has for example x.x.x.15 as it’s IP, the other docker services that run (for example swag with x.x.x.16) and bind their ip automatically to the network interface. Does the mailcow containers then also bind network interface?

esackbauer

aronmal
IPv6 Bindings are explained, you need to read the whole page:
https://docs.mailcow.email/post_installation/firststeps-ip_bindings/#ipv6-binding

aronmal

Wow, now I feel dumb. Don’t know how I missed that. Thanks for confirming that!

aronmal

I have a problem now, i did add the snat and ip bindings, but I got an error for the ipv6 binding.

I now manually added br0 (external) to networks and to the services in the override yml. I am running on unraid. But now I was able to start the containers, but I cant reach them via the binding ips.